The vulnerability in the Linux kernel’s ctnetlink code path arises from manual validation failures that permitted out‑of‑range values to be accepted by Netlink. In particular, the TCP window scale option previously accepted a shift count of 0-255, which is beyond the allowed maximum of 14. Using an illegal shift count can lead to undefined behavior and a kernel crash. The patch replaces these checks with Netlink policy annotations so that the kernel rejects such values at policy level, preventing the faulty code from executing.

All Linux kernel releases that contain the unpatched ctnetlink implementation. The fix was merged in commit 2ef71307c86a9f866d6e28f1a0c06e2e9d794474; any downstream distribution shipping a kernel prior to that commit is susceptible. The affected system type is the kernel itself, with no vendor‑specific product constraint beyond the Linux kernel.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is reported as less than 1%, showing a very low probability of exploitation in current deployments. The CVE is not listed in the CISA KEV catalog. The description does not explicitly state the required privilege level or whether the attack is local; based on the nature of the Netlink interface, the attack vector is inferred to be local or require elevated privileges. If an attacker can send malformed Netlink messages to ctnetlink, the kernel may crash, leading to a denial of service for the affected host.